From c210d918b24b52caff784ec2631e260ed9156502 Mon Sep 17 00:00:00 2001
From: Daniel Friedman <dfriedman58@gmail.com>
Date: Wed, 23 Mar 2016 10:48:35 -0400
Subject: [PATCH] Make CMS 404 template safe by default

---
 cms/templates/404.html | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/cms/templates/404.html b/cms/templates/404.html
index 455bd5ce14..8753d39ee1 100644
--- a/cms/templates/404.html
+++ b/cms/templates/404.html
@@ -1,4 +1,8 @@
-<%! from django.utils.translation import ugettext as _ %>
+<%page expression_filter="h"/>
+<%!
+from django.utils.translation import ugettext as _
+from openedx.core.djangolib.markup import Text, HTML
+%>
 <%inherit file="base.html" />
 <%block name="title">${_("Page Not Found")}</%block>
 <%block name="bodyclass">view-util util-404</%block>
@@ -11,12 +15,14 @@
       <h1 class="title title-1">${_("Page not found")}</h1>
     </header>
     <article class="content-primary" role="main">
-      <p>${_('The page that you were looking for was not found.')}
-       ${_('Go back to the {homepage} or let us know about any pages that may have been moved at {email}.').format(
-            homepage='<a href="/">homepage</a>',
-            email=u'<a href="mailto:{address}">{address}</a>'.format(
-                address=settings.TECH_SUPPORT_EMAIL,
-            ))}
+      <p>
+      ${_('The page that you were looking for was not found.')}
+      ${Text(_('Go back to the {homepage} or let us know about any pages that may have been moved at {email}.')).format(
+        homepage=HTML('<a href="/">homepage</a>'),
+        email=HTML('<a href="mailto:{address}">{address}</a>'.format(
+          address=Text(settings.TECH_SUPPORT_EMAIL)
+        ))
+      )}
       </p>
     </article>
   </section>